Windows sysinternals

More documents

Recommendations

Info

Chapter 6 Pstools 205 <strong>Windows</strong> timeout for computer connections, can severely lengthen shutdown operations that run against many computers. The –n option gives you the ability to shorten the length of time that PsShutdown will attempt to establish a connection before giving up. The shutdown reason codes that can be used with the –e option are listed here: Type Major Minor Title U 0 0 Other (Unplanned) P 0 0 Other (Planned) U 1 1 Hardware: Maintenance (Unplanned) P 1 1 Hardware: Maintenance (Planned) U 1 2 Hardware: Installation (Unplanned) P 1 2 Hardware: Installation (Planned) U 2 2 Operating System: Recovery (Planned) P 2 2 Operating System: Recovery (Planned) P 2 3 Operating System: Upgrade (Planned) U 2 4 Operating System: Reconfiguration (Unplanned) P 2 4 Operating System: Reconfiguration (Planned) P 2 16 Operating System: Service pack (Planned) U 2 17 Operating System: Hot fix (Unplanned) P 2 17 Operating System: Hot fix (Planned) U 2 18 Operating System: Security fix (Unplanned) P 2 18 Operating System: Security fix (Planned) U 4 1 Application: Maintenance (Unplanned) P 4 1 Application: Maintenance (Planned) P 4 2 Application: Installation (Planned) U 4 5 Application: Unresponsive U 4 6 Application: Unstable U 5 19 Security issue P 5 19 Security issue U 5 20 Loss of network connectivity (Unplanned) P 7 0 Legacy API shutdown The System event log might show errors relating to PsShutdown. Cancellation of a shutdown operation might be reported as an unexpected termination of the PsShutdown service; the log might also report an error because PsShutdown is configured as an interactive service. Both of these errors can be ignored. PsSuspend PsSuspend lets you suspend processes on the local system or a remote system. This can be useful if a process is consuming a resource (such as CPU) that you want to allow another process to use. Rather than kill the process that’s consuming the resource, suspending it permits you to let it continue operation at some later point in time. It can also be useful when investigating or removing malware that involve multiple processes monitoring each other for termination. www.it-ebooks.info
206 Part II Usage Guide To suspend a single process, specify its process ID (PID) on the PsSuspend command line. Specify a process name to suspend all processes that have that name. To resume a process, add –r to the command line. Each thread in a process has a suspend count so that each call to the SuspendThread API for that thread must be matched by a ResumeThread call before the thread will resume execution. PsSuspend preserves the suspend counts of threads within a process so that threads that were already suspended when the process was suspended by PsSuspend will remain suspended when the process is resumed. If PsSuspend –r is invoked on a process that is not suspended but that has suspended threads, those threads will have their suspend counts decremented and will resume execution if decremented to zero. Programs that have suspended threads most likely have reasons for doing so, so you should be careful about “ resuming” processes you did not suspend. PsTools Command-Line Syntax This section shows the command-line syntax for each of the PsTools utilities. Because the syntax for remote operations is consistent across the utilities, that syntax is shown here instead of within each utility. The RemoteComputers syntax applies to all of the utilities that can operate on multiple computers; the RemoteComputer syntax applies to those that can operate on only one remote computer. RemoteComputers = \\computer[,computer2[,...]]|\\*|@file [-u username [-p password]] RemoteComputer = \\computer [-u username [-p password]] PsExec psexec [RemoteComputers] [-d] [-background|-low|-belownormal|-abovenormal|-high|-realtime] [-a n[,n[,...]]] [-c [-f|-v]] [-n seconds] [-s|-e] [-i [session]] [-x] [-w directory] [-h] [-l] [-u username [-p password]] command [arguments] Unlike the other utilities, PsExec supports the use of the –u and –p options both for remote and local operations. PsFile psfile [RemoteComputer] [[Id | path] [-c]] PsGetSid psgetsid [RemoteComputers] [name | SID] www.it-ebooks.info
Page 1 and 2:
www.it-ebooks.info
Page 3 and 4:
PUBLISHED BY Microsoft Press A Divi
Page 5 and 6:
www.it-ebooks.info
Page 7 and 8:
www.it-ebooks.info
Page 9 and 10:
viii Table of Contents 2 Windows Co
Page 11 and 12:
x Table of Contents Process Tree .
Page 13 and 14:
xii Table of Contents PsLogList. .
Page 15 and 16:
xiv Table of Contents Object Type .
Page 17 and 18:
xvi Table of Contents 14 System Inf
Page 19 and 20:
www.it-ebooks.info
Page 21 and 22:
www.it-ebooks.info
Page 23 and 24:
xxii Introduction layout, I set out
Page 25 and 26:
xxiv Introduction Microsoft had bee
Page 27 and 28:
xxvi Introduction Part III, “Trou
Page 29 and 30:
xxviii Introduction Errata & Book S
Page 31 and 32:
www.it-ebooks.info
Page 33 and 34:
4 Part I Getting Started Table 1-1
Page 35 and 36:
6 Part I Getting Started Utility LD
Page 37 and 38:
8 Part I Getting Started FIGURE 1-2
Page 39 and 40:
10 Part I Getting Started Running t
Page 41 and 42:
12 Part I Getting Started FIGURE 1-
Page 43 and 44:
14 Part I Getting Started Because t
Page 45 and 46:
16 Part I Getting Started unrestric
Page 47 and 48:
18 Part I Getting Started For more
Page 49 and 50:
20 Part I Getting Started FIGURE 2-
Page 51 and 52:
22 Part I Getting Started ■ The c
Page 53 and 54:
24 Part I Getting Started “System
Page 55 and 56:
26 Part I Getting Started is not av
Page 57 and 58:
28 Part I Getting Started symbolic
Page 59 and 60:
30 Part I Getting Started The debug
Page 61 and 62:
32 Part I Getting Started Terminal
Page 63 and 64:
34 Part I Getting Started access on
Page 65 and 66:
36 Part I Getting Started With UIPI
Page 67 and 68:
www.it-ebooks.info
Page 69 and 70:
40 Part II Usage Guide ■ Tooltips
Page 71 and 72:
42 Part II Usage Guide Procexp repr
Page 73 and 74:
44 Part II Usage Guide is simply th
Page 75 and 76:
46 Part II Usage Guide Updating the
Page 77 and 78:
48 Part II Usage Guide Tooltips Hov
Page 79 and 80:
50 Part II Usage Guide On Windows V
Page 81 and 82:
52 Part II Usage Guide FIGURE 3-6 D
Page 83 and 84:
54 Part II Usage Guide FIGURE 3-7 T
Page 85 and 86:
56 Part II Usage Guide Process Perf
Page 87 and 88:
58 Part II Usage Guide FIGURE 3-9 T
Page 89 and 90:
60 Part II Usage Guide FIGURE 3-10
Page 91 and 92:
62 Part II Usage Guide By default,
Page 93 and 94:
Page 95 and 96:
66 Part II Usage Guide You can disp
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
72 Part II Usage Guide Peering Deep
Page 103 and 104:
Page 105 and 106:
76 Part II Usage Guide ■ Access M
Page 107 and 108:
78 Part II Usage Guide The Properti
Page 109 and 110:
Page 111 and 112:
82 Part II Usage Guide TCP/IP Tab A
Page 113 and 114:
84 Part II Usage Guide In most circ
Page 115 and 116:
86 Part II Usage Guide Click the Sa
Page 117 and 118:
Page 119 and 120:
Page 121 and 122:
92 Part II Usage Guide Some reasons
Page 123 and 124:
94 Part II Usage Guide available to
Page 125 and 126:
96 Part II Usage Guide running on t
Page 127 and 128:
98 Part II Usage Guide Command-Line
Page 129 and 130:
www.it-ebooks.info
Page 131 and 132:
102 Part II Usage Guide Because mil
Page 133 and 134:
104 Part II Usage Guide Events Tabl
Page 135 and 136:
106 Part II Usage Guide As an NTSTA
Page 137 and 138:
108 Part II Usage Guide Application
Page 139 and 140:
110 Part II Usage Guide File Attrib
Page 141 and 142:
112 Part II Usage Guide ■ When th
Page 143 and 144:
114 Part II Usage Guide Displaying
Page 145 and 146:
116 Part II Usage Guide invoked by
Page 147 and 148:
118 Part II Usage Guide without per
Page 149 and 150:
120 Part II Usage Guide Configuring
Page 151 and 152:
Page 153 and 154:
124 Part II Usage Guide Saving Proc
Page 155 and 156:
126 Part II Usage Guide If Procmon
Page 157 and 158:
128 Part II Usage Guide When lookin
Page 159 and 160:
130 Part II Usage Guide History Dep
Page 161 and 162:
132 Part II Usage Guide Automating
Page 163 and 164:
134 Part II Usage Guide ■ Line 4
Page 165 and 166:
136 Part II Usage Guide File Summar
Page 167 and 168:
Page 169 and 170:
140 Part II Usage Guide Cross Refer
Page 171 and 172:
142 Part II Usage Guide BOOL WriteP
Page 173 and 174:
www.it-ebooks.info
Page 175 and 176:
Page 177 and 178:
148 Part II Usage Guide Disabling o
Page 179 and 180:
150 Part II Usage Guide Files for w
Page 181 and 182:
152 Part II Usage Guide Viewing ASE
Page 183 and 184: 154 Part II Usage Guide Per-User AS
Page 185 and 186: 156 Part II Usage Guide Per-User AS
Page 187 and 188: 158 Part II Usage Guide Per-User an
Page 189 and 190: 160 Part II Usage Guide Codecs The
Page 191 and 192: 162 Part II Usage Guide Command Pro
Page 193 and 194: 164 Part II Usage Guide Winsock Pro
Page 195 and 196: 166 Part II Usage Guide Saving and
Page 197 and 198: 168 Part II Usage Guide The CSV for
Page 199 and 200: 170 Part II Usage Guide ■ A defau
Page 201 and 202: 172 Part II Usage Guide Incidentall
Page 203 and 204: 174 Part II Usage Guide Alternate C
Page 205 and 206: 176 Part II Usage Guide What this m
Page 207 and 208: 178 Part II Usage Guide Redirected
Page 209 and 210: 180 Part II Usage Guide PsExec Comm
Page 211 and 212: 182 Part II Usage Guide The -s opti
Page 213 and 214: 184 Part II Usage Guide Note The re
Page 215 and 216: 186 Part II Usage Guide Use of full
Page 217 and 218: 188 Part II Usage Guide In the prec
Page 219 and 220: 190 Part II Usage Guide Note PsList
Page 221 and 222: 192 Part II Usage Guide on the netw
Page 223 and 224: 194 Part II Usage Guide By default,
Page 225 and 226: 196 Part II Usage Guide the event l
Page 227 and 228: 198 Part II Usage Guide example, al
Page 229 and 230: 200 Part II Usage Guide The config
Page 231 and 232: 202 Part II Usage Guide Find One of
Page 233: 204 Part II Usage Guide Option Disp
Page 237 and 238: 208 Part II Usage Guide depend serv
Page 239 and 240: www.it-ebooks.info
Page 241 and 242: 212 Part II Usage Guide FIGURE 7-1
Page 245 and 246: 216 Part II Usage Guide Allocations
Page 247 and 248: 218 Part II Usage Guide ■ Shared
Page 249 and 250: 220 Part II Usage Guide When you co
Page 251 and 252: 222 Part II Usage Guide ■ The mem
Page 255 and 256: 226 Part II Usage Guide ■ .TXT Th
Page 257 and 258: 228 Part II Usage Guide Command-Lin
Page 259 and 260: 230 Part II Usage Guide To avoid an
Page 261 and 262: 232 Part II Usage Guide You can use
Page 263 and 264: 234 Part II Usage Guide and results
Page 265 and 266: 236 Part II Usage Guide Capturing A
Page 267 and 268: 238 Part II Usage Guide static meth
Page 269 and 270: 240 Part II Usage Guide You can ann
Page 271 and 272: 242 Part II Usage Guide the crash d
Page 273 and 274: 244 Part II Usage Guide Highlightin
Page 275 and 276: 246 Part II Usage Guide ■ Limit L
Page 277 and 278: 248 Part II Usage Guide To view deb
Page 279 and 280: 250 Part II Usage Guide LiveKd Requ
Page 281 and 282: 252 Part II Usage Guide This comman
Page 283 and 284: 254 Part II Usage Guide ListDLLs re
Page 285 and 286:
256 Part II Usage Guide Handle Hand
Page 287 and 288:
Page 289 and 290:
260 Part II Usage Guide Timer : 7 T
Page 291 and 292:
Page 293 and 294:
264 Part II Usage Guide ■ Signing
Page 295 and 296:
266 Part II Usage Guide displays ha
Page 297 and 298:
268 Part II Usage Guide Note that t
Page 299 and 300:
270 Part II Usage Guide Object Type
Page 301 and 302:
272 Part II Usage Guide Although th
Page 303 and 304:
274 Part II Usage Guide effective p
Page 305 and 306:
276 Part II Usage Guide is explicit
Page 307 and 308:
278 Part II Usage Guide Click on a
Page 309 and 310:
280 Part II Usage Guide ShellRunAs
Page 311 and 312:
282 Part II Usage Guide [1] Logon s
Page 313 and 314:
284 Part II Usage Guide The only wa
Page 315 and 316:
286 Part II Usage Guide The second
Page 317 and 318:
Page 319 and 320:
290 Part II Usage Guide Objects You
Page 321 and 322:
Page 323 and 324:
294 Part II Usage Guide The current
Page 325 and 326:
296 Part II Usage Guide You can scr
Page 327 and 328:
Page 329 and 330:
300 Part II Usage Guide To view inf
Page 331 and 332:
302 Part II Usage Guide AdInsight m
Page 333 and 334:
304 Part II Usage Guide To configur
Page 335 and 336:
306 Part II Usage Guide AdInsight c
Page 337 and 338:
www.it-ebooks.info
Page 339 and 340:
310 Part II Usage Guide When you st
Page 341 and 342:
312 Part II Usage Guide In addition
Page 343 and 344:
314 Part II Usage Guide selected, B
Page 345 and 346:
316 Part II Usage Guide the data it
Page 347 and 348:
Page 349 and 350:
320 Part II Usage Guide provide a w
Page 351 and 352:
322 Part II Usage Guide Drawing Mod
Page 353 and 354:
324 Part II Usage Guide LiveZoom Wh
Page 355 and 356:
326 Part II Usage Guide The followi
Page 357 and 358:
Page 359 and 360:
330 Part II Usage Guide into subdir
Page 361 and 362:
332 Part II Usage Guide By default,
Page 363 and 364:
334 Part II Usage Guide This sample
Page 365 and 366:
Page 367 and 368:
338 Part II Usage Guide disk), Disk
Page 369 and 370:
340 Part II Usage Guide Volume Perm
Page 371 and 372:
Page 373 and 374:
344 Part II Usage Guide ■ One lin
Page 375 and 376:
Page 377 and 378:
348 Part II Usage Guide sizing, and
Page 379 and 380:
350 Part II Usage Guide VolumeID Wh
Page 381 and 382:
352 Part II Usage Guide executables
Page 383 and 384:
354 Part II Usage Guide ■ System
Page 385 and 386:
356 Part II Usage Guide ■ Process
Page 387 and 388:
Page 389 and 390:
360 Part II Usage Guide costs on NU
Page 391 and 392:
Page 393 and 394:
Page 395 and 396:
Page 397 and 398:
www.it-ebooks.info
Page 399 and 400:
370 Part II Usage Guide and endpoin
Page 401 and 402:
Page 403 and 404:
Page 405 and 406:
376 Part II Usage Guide adjacent if
Page 407 and 408:
378 Part II Usage Guide Hex2Dec If
Page 409 and 410:
380 Part II Usage Guide his audienc
Page 411 and 412:
www.it-ebooks.info
Page 413 and 414:
384 Part III Troubleshooting—”T
Page 415 and 416:
Page 417 and 418:
Page 419 and 420:
Page 421 and 422:
Page 423 and 424:
Page 425 and 426:
Page 427 and 428:
Page 429 and 430:
Page 431 and 432:
Page 433 and 434:
Page 435 and 436:
Page 437 and 438:
Page 439 and 440:
Page 441 and 442:
Page 443 and 444:
Page 445 and 446:
Page 447 and 448:
Page 449 and 450:
Page 451 and 452:
Page 453 and 454:
Page 455 and 456:
Page 457 and 458:
Page 459 and 460:
Page 461 and 462:
Page 463 and 464:
Page 465 and 466:
Page 467 and 468:
438 AdInsight AdInsight (continued)
Page 469 and 470:
440 BgInfo BgInfo (continued) Rich
Page 471 and 472:
442 DebugView DebugView (continued)
Page 473 and 474:
444 events events (continued) filte
Page 475 and 476:
446 HKLM\System\CurrentControlSet\C
Page 477 and 478:
448 malware malware (continued) Aut
Page 479 and 480:
450 paging files, defragmenting pag
Page 481 and 482:
452 Process Monitor (Procmon) Proce
Page 483 and 484:
454 PsShutdown PsShutdown (continue
Page 485 and 486:
456 Security Reference Monitor Secu
Page 487 and 488:
458 Sysinternals utilities Sysinter
Page 489 and 490:
460 unhandled exceptions, process d
Page 491 and 492:
462 Windows 7 Windows 7 (continued)
Page 493 and 494:
www.it-ebooks.info
Page 495 and 496:
www.it-ebooks.info
Page 497:
What do you think of this book? We
show all

Windows sysinternals

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?